From 9fc50746ca6981becc7d2e6df9a611c835da685f Mon Sep 17 00:00:00 2001 From: Yas Date: Tue, 23 Apr 2024 12:28:57 +1000 Subject: [PATCH] feat: `avm/res/sql/instance-pool` (#1714) ## Description This PR adds the new Azure SQL Instance pool and its tests Closes [Module Proposal : avm/res/sql/instance-pool](#752) ## Pipeline Reference | Pipeline | | -------- | | [![avm.res.sql.instance-pool](https://github.com/yashints/bicep-registry-modules/actions/workflows/avm.res.sql.instance-pool.yml/badge.svg)](https://github.com/yashints/bicep-registry-modules/actions/workflows/avm.res.sql.instance-pool.yml) | ## Type of Change - [ ] Update to CI Environment or utlities (Non-module effecting changes) - [x] Azure Verified Module updates: - [ ] Bugfix containing backwards compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`: - [ ] Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description. - [ ] The bug was found by the module author, and no one has opened an issue to report it yet. - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`. - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`. - [ ] Update to documentation ## Checklist - [x] I'm sure there are no other open Pull Requests for the same update/change - [x] I have run `Set-AVMModule` locally to generate the supporting module files. - [x] My corresponding pipelines / checks run clean and green without any errors or warnings --- .github/CODEOWNERS | 1 + .github/ISSUE_TEMPLATE/avm_module_issue.yml | 1 + .../workflows/avm.res.sql.instance-pool.yml | 86 ++++++ avm/res/sql/instance-pool/README.md | 286 ++++++++++++++++++ avm/res/sql/instance-pool/main.bicep | 102 +++++++ avm/res/sql/instance-pool/main.json | 176 +++++++++++ .../tests/e2e/defaults/dependencies.bicep | 286 ++++++++++++++++++ .../tests/e2e/defaults/main.test.bicep | 61 ++++ .../tests/e2e/waf-aligned/dependencies.bicep | 286 ++++++++++++++++++ .../tests/e2e/waf-aligned/main.test.bicep | 62 ++++ avm/res/sql/instance-pool/version.json | 7 + 11 files changed, 1354 insertions(+) create mode 100644 .github/workflows/avm.res.sql.instance-pool.yml create mode 100644 avm/res/sql/instance-pool/README.md create mode 100644 avm/res/sql/instance-pool/main.bicep create mode 100644 avm/res/sql/instance-pool/main.json create mode 100644 avm/res/sql/instance-pool/tests/e2e/defaults/dependencies.bicep create mode 100644 avm/res/sql/instance-pool/tests/e2e/defaults/main.test.bicep create mode 100644 avm/res/sql/instance-pool/tests/e2e/waf-aligned/dependencies.bicep create mode 100644 avm/res/sql/instance-pool/tests/e2e/waf-aligned/main.test.bicep create mode 100644 avm/res/sql/instance-pool/version.json diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 0734b0fb91..68a24d86e1 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -131,6 +131,7 @@ /avm/res/service-fabric/cluster/ @Azure/avm-res-servicefabric-cluster-module-owners-bicep @Azure/avm-core-team-technical-bicep /avm/res/signal-r-service/signal-r/ @Azure/avm-res-signalrservice-signalr-module-owners-bicep @Azure/avm-core-team-technical-bicep /avm/res/signal-r-service/web-pub-sub/ @Azure/avm-res-signalrservice-webpubsub-module-owners-bicep @Azure/avm-core-team-technical-bicep +/avm/res/sql/instance-pool/ @Azure/avm-res-sql-instancepool-module-owners-bicep @Azure/avm-core-team-technical-bicep /avm/res/sql/managed-instance/ @Azure/avm-res-sql-managedinstance-module-owners-bicep @Azure/avm-core-team-technical-bicep /avm/res/sql/server/ @Azure/avm-res-sql-server-module-owners-bicep @Azure/avm-core-team-technical-bicep /avm/res/storage/storage-account/ @Azure/avm-res-storage-storageaccount-module-owners-bicep @Azure/avm-core-team-technical-bicep diff --git a/.github/ISSUE_TEMPLATE/avm_module_issue.yml b/.github/ISSUE_TEMPLATE/avm_module_issue.yml index 8ad0c07acd..9a7da432aa 100644 --- a/.github/ISSUE_TEMPLATE/avm_module_issue.yml +++ b/.github/ISSUE_TEMPLATE/avm_module_issue.yml @@ -164,6 +164,7 @@ body: - "avm/res/service-fabric/cluster" - "avm/res/signal-r-service/signal-r" - "avm/res/signal-r-service/web-pub-sub" + - "avm/res/sql/instance-pool" - "avm/res/sql/managed-instance" - "avm/res/sql/server" - "avm/res/storage/storage-account" diff --git a/.github/workflows/avm.res.sql.instance-pool.yml b/.github/workflows/avm.res.sql.instance-pool.yml new file mode 100644 index 0000000000..75f6103864 --- /dev/null +++ b/.github/workflows/avm.res.sql.instance-pool.yml @@ -0,0 +1,86 @@ +name: "avm.res.sql.instance-pool" + +on: + schedule: + - cron: "0 12 1/15 * *" # Bi-Weekly Test (on 1st & 15th of month) + workflow_dispatch: + inputs: + staticValidation: + type: boolean + description: "Execute static validation" + required: false + default: true + deploymentValidation: + type: boolean + description: "Execute deployment validation" + required: false + default: true + removeDeployment: + type: boolean + description: "Remove deployed module" + required: false + default: false + push: + branches: + - main + paths: + - ".github/actions/templates/avm-**" + - ".github/workflows/avm.template.module.yml" + - ".github/workflows/avm.res.sql.instance-pool.yml" + - "avm/res/sql/instance-pool/**" + - "avm/utilities/pipelines/**" + - "!avm/utilities/pipelines/platform/**" + - "!*/**/README.md" + +env: + modulePath: "avm/res/sql/instance-pool" + workflowPath: ".github/workflows/avm.res.sql.instance-pool.yml" + +concurrency: + group: ${{ github.workflow }} + +jobs: + ########################### + # Initialize pipeline # + ########################### + job_initialize_pipeline: + runs-on: ubuntu-latest + name: "Initialize pipeline" + steps: + - name: "Checkout" + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: "Set input parameters to output variables" + id: get-workflow-param + uses: ./.github/actions/templates/avm-getWorkflowInput + with: + workflowPath: "${{ env.workflowPath}}" + - name: "Get module test file paths" + id: get-module-test-file-paths + uses: ./.github/actions/templates/avm-getModuleTestFiles + with: + modulePath: "${{ env.modulePath }}" + outputs: + workflowInput: ${{ steps.get-workflow-param.outputs.workflowInput }} + moduleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.moduleTestFilePaths }} + psRuleModuleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.psRuleModuleTestFilePaths }} + modulePath: "${{ env.modulePath }}" + + ############################## + # Call reusable workflow # + ############################## + call-workflow-passing-data: + name: "Run" + permissions: + id-token: write # For OIDC + contents: write # For release tags + needs: + - job_initialize_pipeline + uses: ./.github/workflows/avm.template.module.yml + with: + workflowInput: "${{ needs.job_initialize_pipeline.outputs.workflowInput }}" + moduleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.moduleTestFilePaths }}" + psRuleModuleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.psRuleModuleTestFilePaths }}" + modulePath: "${{ needs.job_initialize_pipeline.outputs.modulePath}}" + secrets: inherit diff --git a/avm/res/sql/instance-pool/README.md b/avm/res/sql/instance-pool/README.md new file mode 100644 index 0000000000..68e73a8f95 --- /dev/null +++ b/avm/res/sql/instance-pool/README.md @@ -0,0 +1,286 @@ +# SQL Server Instance Pool `[Microsoft.Sql/instancePools]` + +This module deploys an Azure SQL Server Instance Pool. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Usage examples](#Usage-examples) +- [Parameters](#Parameters) +- [Outputs](#Outputs) +- [Cross-referenced modules](#Cross-referenced-modules) +- [Data Collection](#Data-Collection) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Sql/instancePools` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Sql/2023-05-01-preview/instancePools) | + +## Usage examples + +The following section provides usage examples for the module, which were used to validate and deploy the module successfully. For a full reference, please review the module's test folder in its repository. + +>**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order. + +>**Note**: To reference the module, please use the following syntax `br/public:avm/res/sql/instance-pool:`. + +- [Using only defaults](#example-1-using-only-defaults) +- [WAF-aligned](#example-2-waf-aligned) + +### Example 1: _Using only defaults_ + +This instance deploys the module with the minimum set of required parameters. + + +
+ +via Bicep module + +```bicep +module instancePool 'br/public:avm/res/sql/instance-pool:' = { + name: 'instancePoolDeployment' + params: { + // Required parameters + name: '' + subnetResourceId: '' + // Non-required parameters + location: '' + } +} +``` + +
+

+ +

+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + // Required parameters + "name": { + "value": "" + }, + "subnetResourceId": { + "value": "" + }, + // Non-required parameters + "location": { + "value": "" + } + } +} +``` + +
+

+ +### Example 2: _WAF-aligned_ + +This instance deploys the module in alignment with the best-practices of the Well-Architected Framework. + + +

+ +via Bicep module + +```bicep +module instancePool 'br/public:avm/res/sql/instance-pool:' = { + name: 'instancePoolDeployment' + params: { + // Required parameters + name: '' + subnetResourceId: '' + // Non-required parameters + location: '' + skuName: 'GP_Gen8IM' + } +} +``` + +
+

+ +

+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + // Required parameters + "name": { + "value": "" + }, + "subnetResourceId": { + "value": "" + }, + // Non-required parameters + "location": { + "value": "" + }, + "skuName": { + "value": "GP_Gen8IM" + } + } +} +``` + +
+

+ + +## Parameters + +**Required parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`name`](#parameter-name) | string | The name of the instance pool. | +| [`subnetResourceId`](#parameter-subnetresourceid) | string | The subnet resource ID for the instance pool. | + +**Optional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. | +| [`licenseType`](#parameter-licensetype) | string | The license type to apply for this database. | +| [`location`](#parameter-location) | string | Location for all resources. | +| [`skuFamily`](#parameter-skufamily) | string | If the service has different generations of hardware, for the same SKU, then that can be captured here. | +| [`skuName`](#parameter-skuname) | string | The SKU name for the instance pool. | +| [`tags`](#parameter-tags) | object | Tags of the resource. | +| [`tier`](#parameter-tier) | string | The vCore service tier for the instance pool. | +| [`vCores`](#parameter-vcores) | int | The number of vCores for the instance pool. | + +### Parameter: `name` + +The name of the instance pool. + +- Required: Yes +- Type: string + +### Parameter: `subnetResourceId` + +The subnet resource ID for the instance pool. + +- Required: Yes +- Type: string + +### Parameter: `enableTelemetry` + +Enable/Disable usage telemetry for module. + +- Required: No +- Type: bool +- Default: `True` + +### Parameter: `licenseType` + +The license type to apply for this database. + +- Required: No +- Type: string +- Default: `'BasePrice'` +- Allowed: + ```Bicep + [ + 'BasePrice' + 'LicenseIncluded' + ] + ``` + +### Parameter: `location` + +Location for all resources. + +- Required: No +- Type: string +- Default: `[resourceGroup().location]` + +### Parameter: `skuFamily` + +If the service has different generations of hardware, for the same SKU, then that can be captured here. + +- Required: No +- Type: string +- Default: `'Gen5'` + +### Parameter: `skuName` + +The SKU name for the instance pool. + +- Required: No +- Type: string +- Default: `'GP_Gen5'` + +### Parameter: `tags` + +Tags of the resource. + +- Required: No +- Type: object + +### Parameter: `tier` + +The vCore service tier for the instance pool. + +- Required: No +- Type: string +- Default: `'GeneralPurpose'` +- Allowed: + ```Bicep + [ + 'GeneralPurpose' + ] + ``` + +### Parameter: `vCores` + +The number of vCores for the instance pool. + +- Required: No +- Type: int +- Default: `8` +- Allowed: + ```Bicep + [ + 8 + 16 + 24 + 32 + 40 + 64 + 80 + 96 + 128 + 160 + 192 + 224 + 256 + ] + ``` + + +## Outputs + +| Output | Type | Description | +| :-- | :-- | :-- | +| `instancePoolLocation` | string | The location of the SQL instance pool. | +| `name` | string | The name of the SQL instance pool. | +| `resourceGroupName` | string | The resource group name of the SQL instance pool. | +| `resourceId` | string | The ID of the SQL instance pool. | + +## Cross-referenced modules + +_None_ + +## Data Collection + +The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the [repository](https://aka.ms/avm/telemetry). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at . You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices. diff --git a/avm/res/sql/instance-pool/main.bicep b/avm/res/sql/instance-pool/main.bicep new file mode 100644 index 0000000000..088cd87ada --- /dev/null +++ b/avm/res/sql/instance-pool/main.bicep @@ -0,0 +1,102 @@ +metadata name = 'SQL Server Instance Pool' +metadata description = 'This module deploys an Azure SQL Server Instance Pool.' +metadata owner = 'Azure/module-maintainers' + +@description('Required. The name of the instance pool.') +param name string + +@description('Optional. Location for all resources.') +param location string = resourceGroup().location + +@description('Optional. Tags of the resource.') +param tags object? + +@description('Required. The subnet resource ID for the instance pool.') +param subnetResourceId string + +@description('Optional. The license type to apply for this database.') +@allowed([ + 'BasePrice' + 'LicenseIncluded' +]) +param licenseType string = 'BasePrice' + +@description('Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here.') +param skuFamily string = 'Gen5' + +@description('Optional. The number of vCores for the instance pool.') +@allowed([ + 8 + 16 + 24 + 32 + 40 + 64 + 80 + 96 + 128 + 160 + 192 + 224 + 256 +]) +param vCores int = 8 + +@description('Optional. The vCore service tier for the instance pool.') +@allowed([ + 'GeneralPurpose' +]) +param tier string = 'GeneralPurpose' + +@description('Optional. The SKU name for the instance pool.') +param skuName string = 'GP_Gen5' + +@description('Optional. Enable/Disable usage telemetry for module.') +param enableTelemetry bool = true + +resource instancePool 'Microsoft.Sql/instancePools@2023-05-01-preview' = { + name: name + location: location + tags: tags + sku: { + family: skuFamily + name: skuName + tier: tier + } + properties: { + licenseType: licenseType + subnetId: subnetResourceId + vCores: vCores + } +} + +resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = + if (enableTelemetry) { + name: '46d3xbcp.res.sql-instancepool.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}' + properties: { + mode: 'Incremental' + template: { + '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#' + contentVersion: '1.0.0.0' + resources: [] + outputs: { + telemetry: { + type: 'String' + value: 'For more information, see https://aka.ms/avm/TelemetryInfo' + } + } + } + } + } + +@description('The ID of the SQL instance pool.') +output resourceId string = instancePool.id + +@description('The name of the SQL instance pool.') +output name string = instancePool.name + +@description('The location of the SQL instance pool.') +output instancePoolLocation string = instancePool.location + +@description('The resource group name of the SQL instance pool.') +output resourceGroupName string = resourceGroup().name diff --git a/avm/res/sql/instance-pool/main.json b/avm/res/sql/instance-pool/main.json new file mode 100644 index 0000000000..684f086ed4 --- /dev/null +++ b/avm/res/sql/instance-pool/main.json @@ -0,0 +1,176 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.26.170.59819", + "templateHash": "1210707271653756300" + }, + "name": "SQL Server Instance Pool", + "description": "This module deploys an Azure SQL Server Instance Pool.", + "owner": "Azure/module-maintainers" + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the instance pool." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. The subnet resource ID for the instance pool." + } + }, + "licenseType": { + "type": "string", + "defaultValue": "BasePrice", + "allowedValues": [ + "BasePrice", + "LicenseIncluded" + ], + "metadata": { + "description": "Optional. The license type to apply for this database." + } + }, + "skuFamily": { + "type": "string", + "defaultValue": "Gen5", + "metadata": { + "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here." + } + }, + "vCores": { + "type": "int", + "defaultValue": 8, + "allowedValues": [ + 8, + 16, + 24, + 32, + 40, + 64, + 80, + 96, + 128, + 160, + 192, + 224, + 256 + ], + "metadata": { + "description": "Optional. The number of vCores for the instance pool." + } + }, + "tier": { + "type": "string", + "defaultValue": "GeneralPurpose", + "allowedValues": [ + "GeneralPurpose" + ], + "metadata": { + "description": "Optional. The vCore service tier for the instance pool." + } + }, + "skuName": { + "type": "string", + "defaultValue": "GP_Gen5", + "metadata": { + "description": "Optional. The SKU name for the instance pool." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "instancePool": { + "type": "Microsoft.Sql/instancePools", + "apiVersion": "2023-05-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "family": "[parameters('skuFamily')]", + "name": "[parameters('skuName')]", + "tier": "[parameters('tier')]" + }, + "properties": { + "licenseType": "[parameters('licenseType')]", + "subnetId": "[parameters('subnetResourceId')]", + "vCores": "[parameters('vCores')]" + } + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2023-07-01", + "name": "[format('46d3xbcp.res.sql-instancepool.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The ID of the SQL instance pool." + }, + "value": "[resourceId('Microsoft.Sql/instancePools', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL instance pool." + }, + "value": "[parameters('name')]" + }, + "instancePoolLocation": { + "type": "string", + "metadata": { + "description": "The location of the SQL instance pool." + }, + "value": "[reference('instancePool', '2023-05-01-preview', 'full').location]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group name of the SQL instance pool." + }, + "value": "[resourceGroup().name]" + } + } +} \ No newline at end of file diff --git a/avm/res/sql/instance-pool/tests/e2e/defaults/dependencies.bicep b/avm/res/sql/instance-pool/tests/e2e/defaults/dependencies.bicep new file mode 100644 index 0000000000..772bd070fc --- /dev/null +++ b/avm/res/sql/instance-pool/tests/e2e/defaults/dependencies.bicep @@ -0,0 +1,286 @@ +@description('Optional. The location to deploy resources to.') +param location string = resourceGroup().location + +@description('Required. The name of the Managed Identity to create.') +param managedIdentityName string + +@description('Required. The name of the Deployment Script to create to get the paired region name.') +param pairedRegionScriptName string + +@description('Required. The name of the SQL Instance Pool.') +param sqlInstancePoolName string + +@description('Required. The name of the Virtual Network to create.') +param virtualNetworkName string + +@description('Optional. The name of the Subnet to create.') +param subnetName string = 'sql-instancepool-subnet' + +@description('Required. The name of the NSG to create.') +param nsgName string + +@description('Required. The name of the route table to create.') +param routeTableName string + +var addressPrefix = '10.0.0.0/16' +var subnetAddressPrefix = cidrSubnet(addressPrefix, 24, 0) + +resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { + name: managedIdentityName + location: location +} + +resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { + name: guid('msi-${location}-${managedIdentity.id}-Reader-RoleAssignment') + properties: { + principalId: managedIdentity.properties.principalId + roleDefinitionId: subscriptionResourceId( + 'Microsoft.Authorization/roleDefinitions', + 'acdd72a7-3385-48ef-bd42-f606fba81ae7' + ) // Reader + principalType: 'ServicePrincipal' + } +} + +resource getPairedRegionScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = { + name: pairedRegionScriptName + location: location + kind: 'AzurePowerShell' + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${managedIdentity.id}': {} + } + } + properties: { + azPowerShellVersion: '8.0' + retentionInterval: 'P1D' + arguments: '-Location \\"${location}\\"' + scriptContent: loadTextContent('../../../../../../utilities/e2e-template-assets/scripts/Get-PairedRegion.ps1') + } + dependsOn: [ + roleAssignment + ] +} + +resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { + name: nsgName + location: location + properties: { + securityRules: [ + { + name: 'sqlmi-healthprobe-in' + properties: { + description: 'Allow Azure Load Balancer inbound traffic' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '*' + sourceAddressPrefix: 'AzureLoadBalancer' + destinationAddressPrefix: subnetAddressPrefix + access: 'Allow' + priority: 100 + direction: 'Inbound' + } + } + { + name: 'sqlmi-internal-in' + properties: { + description: 'Allow MI internal inbound traffic' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '*' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: subnetAddressPrefix + access: 'Allow' + priority: 101 + direction: 'Inbound' + } + } + { + name: 'sqlmi-aad-out' + properties: { + description: 'Allow communication with Azure Active Directory over https' + protocol: 'Tcp' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'AzureActiveDirectory' + access: 'Allow' + priority: 101 + direction: 'Outbound' + } + } + { + name: 'sqlmi-onedsc-out' + properties: { + description: 'Allow communication with the One DS Collector over https' + protocol: 'Tcp' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'OneDsCollector' + access: 'Allow' + priority: 102 + direction: 'Outbound' + } + } + { + name: 'sqlmi-internal-out' + properties: { + description: 'Allow MI internal outbound traffic' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '*' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: subnetAddressPrefix + access: 'Allow' + priority: 103 + direction: 'Outbound' + } + } + { + name: 'sqlmi-strg-p-out' + properties: { + description: 'Allow outbound communication with storage over HTTPS' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'Storage.${location}' + access: 'Allow' + priority: 104 + direction: 'Outbound' + } + } + { + name: 'sqlmi-strg-s-out' + properties: { + description: 'Allow outbound communication with storage over HTTPS' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'Storage.${getPairedRegionScript.properties.outputs.pairedRegionName}' + access: 'Allow' + priority: 105 + direction: 'Outbound' + } + } + { + name: 'sqlmi-optional-azure-out' + properties: { + description: 'Allow AzureCloud outbound https traffic' + protocol: 'Tcp' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'AzureCloud' + access: 'Allow' + priority: 100 + direction: 'Outbound' + } + } + ] + } +} + +resource routeTable 'Microsoft.Network/routeTables@2020-06-01' = { + name: routeTableName + location: location + properties: { + disableBgpRoutePropagation: false + routes: [ + { + name: 'sqlmi_subnet-to-vnetlocal' + properties: { + addressPrefix: subnetAddressPrefix + nextHopType: 'VnetLocal' + } + } + { + name: 'sqlmi-aad' + properties: { + addressPrefix: 'AzureActiveDirectory' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-odscollector' + properties: { + addressPrefix: 'OneDsCollector' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-stg-p' + properties: { + addressPrefix: 'Storage.${location}' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-stg-s' + properties: { + addressPrefix: 'Storage.${getPairedRegionScript.properties.outputs.pairedRegionName}' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-optional-azure-p' + properties: { + addressPrefix: 'AzureCloud.${location}' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-optional-azurecloud-s' + properties: { + addressPrefix: 'AzureCloud.${getPairedRegionScript.properties.outputs.pairedRegionName}' + nextHopType: 'Internet' + } + } + ] + } +} + +resource virtualNetwork 'Microsoft.Network/virtualNetworks@2019-11-01' = { + name: virtualNetworkName + location: location + properties: { + addressSpace: { + addressPrefixes: [ + addressPrefix + ] + } + subnets: [ + { + name: subnetName + properties: { + addressPrefix: subnetAddressPrefix + networkSecurityGroup: { + id: nsg.id + } + routeTable: { + id: routeTable.id + } + delegations: [ + { + name: 'ip-delegations-${sqlInstancePoolName}' + properties: { + serviceName: 'Microsoft.Sql/managedInstances' + } + } + ] + privateEndpointNetworkPolicies: 'Disabled' + privateLinkServiceNetworkPolicies: 'Enabled' + } + } + ] + } +} + +@description('The subnetId required for the instance pool creation.') +output subnetId string = virtualNetwork.properties.subnets[0].id + +@description('The name of the sql instnce pool to be created.') +output sqlInstancePoolName string = sqlInstancePoolName diff --git a/avm/res/sql/instance-pool/tests/e2e/defaults/main.test.bicep b/avm/res/sql/instance-pool/tests/e2e/defaults/main.test.bicep new file mode 100644 index 0000000000..677a80dbe1 --- /dev/null +++ b/avm/res/sql/instance-pool/tests/e2e/defaults/main.test.bicep @@ -0,0 +1,61 @@ +targetScope = 'subscription' + +metadata name = 'Using only defaults' +metadata description = 'This instance deploys the module with the minimum set of required parameters.' + +// ========== // +// Parameters // +// ========== // + +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'dep-${namePrefix}-sql.instancepool-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param resourceLocation string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +// e.g., for a module 'network/private-endpoint' you could use 'npe' as a prefix and then 'waf' as a suffix for the waf-aligned test +param serviceShort string = 'sipmin' + +@description('Optional. A token to inject into the name of each resource. This value can be automatically injected by the CI.') +param namePrefix string = '#_namePrefix_#' + +// ============ // +// Dependencies // +// ============ // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: resourceLocation +} + +module nestedDependencies 'dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies' + params: { + virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}' + managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' + pairedRegionScriptName: 'dep-${namePrefix}-ds-${serviceShort}' + nsgName: 'dep-${namePrefix}-nsg-${serviceShort}' + routeTableName: 'dep-${namePrefix}-rt-${serviceShort}' + sqlInstancePoolName: '${namePrefix}${serviceShort}001' + location: resourceLocation + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../../main.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}' + params: { + name: nestedDependencies.outputs.sqlInstancePoolName + location: resourceLocation + subnetResourceId: nestedDependencies.outputs.subnetId + } +} diff --git a/avm/res/sql/instance-pool/tests/e2e/waf-aligned/dependencies.bicep b/avm/res/sql/instance-pool/tests/e2e/waf-aligned/dependencies.bicep new file mode 100644 index 0000000000..772bd070fc --- /dev/null +++ b/avm/res/sql/instance-pool/tests/e2e/waf-aligned/dependencies.bicep @@ -0,0 +1,286 @@ +@description('Optional. The location to deploy resources to.') +param location string = resourceGroup().location + +@description('Required. The name of the Managed Identity to create.') +param managedIdentityName string + +@description('Required. The name of the Deployment Script to create to get the paired region name.') +param pairedRegionScriptName string + +@description('Required. The name of the SQL Instance Pool.') +param sqlInstancePoolName string + +@description('Required. The name of the Virtual Network to create.') +param virtualNetworkName string + +@description('Optional. The name of the Subnet to create.') +param subnetName string = 'sql-instancepool-subnet' + +@description('Required. The name of the NSG to create.') +param nsgName string + +@description('Required. The name of the route table to create.') +param routeTableName string + +var addressPrefix = '10.0.0.0/16' +var subnetAddressPrefix = cidrSubnet(addressPrefix, 24, 0) + +resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { + name: managedIdentityName + location: location +} + +resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { + name: guid('msi-${location}-${managedIdentity.id}-Reader-RoleAssignment') + properties: { + principalId: managedIdentity.properties.principalId + roleDefinitionId: subscriptionResourceId( + 'Microsoft.Authorization/roleDefinitions', + 'acdd72a7-3385-48ef-bd42-f606fba81ae7' + ) // Reader + principalType: 'ServicePrincipal' + } +} + +resource getPairedRegionScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = { + name: pairedRegionScriptName + location: location + kind: 'AzurePowerShell' + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${managedIdentity.id}': {} + } + } + properties: { + azPowerShellVersion: '8.0' + retentionInterval: 'P1D' + arguments: '-Location \\"${location}\\"' + scriptContent: loadTextContent('../../../../../../utilities/e2e-template-assets/scripts/Get-PairedRegion.ps1') + } + dependsOn: [ + roleAssignment + ] +} + +resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { + name: nsgName + location: location + properties: { + securityRules: [ + { + name: 'sqlmi-healthprobe-in' + properties: { + description: 'Allow Azure Load Balancer inbound traffic' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '*' + sourceAddressPrefix: 'AzureLoadBalancer' + destinationAddressPrefix: subnetAddressPrefix + access: 'Allow' + priority: 100 + direction: 'Inbound' + } + } + { + name: 'sqlmi-internal-in' + properties: { + description: 'Allow MI internal inbound traffic' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '*' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: subnetAddressPrefix + access: 'Allow' + priority: 101 + direction: 'Inbound' + } + } + { + name: 'sqlmi-aad-out' + properties: { + description: 'Allow communication with Azure Active Directory over https' + protocol: 'Tcp' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'AzureActiveDirectory' + access: 'Allow' + priority: 101 + direction: 'Outbound' + } + } + { + name: 'sqlmi-onedsc-out' + properties: { + description: 'Allow communication with the One DS Collector over https' + protocol: 'Tcp' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'OneDsCollector' + access: 'Allow' + priority: 102 + direction: 'Outbound' + } + } + { + name: 'sqlmi-internal-out' + properties: { + description: 'Allow MI internal outbound traffic' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '*' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: subnetAddressPrefix + access: 'Allow' + priority: 103 + direction: 'Outbound' + } + } + { + name: 'sqlmi-strg-p-out' + properties: { + description: 'Allow outbound communication with storage over HTTPS' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'Storage.${location}' + access: 'Allow' + priority: 104 + direction: 'Outbound' + } + } + { + name: 'sqlmi-strg-s-out' + properties: { + description: 'Allow outbound communication with storage over HTTPS' + protocol: '*' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'Storage.${getPairedRegionScript.properties.outputs.pairedRegionName}' + access: 'Allow' + priority: 105 + direction: 'Outbound' + } + } + { + name: 'sqlmi-optional-azure-out' + properties: { + description: 'Allow AzureCloud outbound https traffic' + protocol: 'Tcp' + sourcePortRange: '*' + destinationPortRange: '443' + sourceAddressPrefix: subnetAddressPrefix + destinationAddressPrefix: 'AzureCloud' + access: 'Allow' + priority: 100 + direction: 'Outbound' + } + } + ] + } +} + +resource routeTable 'Microsoft.Network/routeTables@2020-06-01' = { + name: routeTableName + location: location + properties: { + disableBgpRoutePropagation: false + routes: [ + { + name: 'sqlmi_subnet-to-vnetlocal' + properties: { + addressPrefix: subnetAddressPrefix + nextHopType: 'VnetLocal' + } + } + { + name: 'sqlmi-aad' + properties: { + addressPrefix: 'AzureActiveDirectory' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-odscollector' + properties: { + addressPrefix: 'OneDsCollector' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-stg-p' + properties: { + addressPrefix: 'Storage.${location}' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-stg-s' + properties: { + addressPrefix: 'Storage.${getPairedRegionScript.properties.outputs.pairedRegionName}' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-optional-azure-p' + properties: { + addressPrefix: 'AzureCloud.${location}' + nextHopType: 'Internet' + } + } + { + name: 'sqlmi-optional-azurecloud-s' + properties: { + addressPrefix: 'AzureCloud.${getPairedRegionScript.properties.outputs.pairedRegionName}' + nextHopType: 'Internet' + } + } + ] + } +} + +resource virtualNetwork 'Microsoft.Network/virtualNetworks@2019-11-01' = { + name: virtualNetworkName + location: location + properties: { + addressSpace: { + addressPrefixes: [ + addressPrefix + ] + } + subnets: [ + { + name: subnetName + properties: { + addressPrefix: subnetAddressPrefix + networkSecurityGroup: { + id: nsg.id + } + routeTable: { + id: routeTable.id + } + delegations: [ + { + name: 'ip-delegations-${sqlInstancePoolName}' + properties: { + serviceName: 'Microsoft.Sql/managedInstances' + } + } + ] + privateEndpointNetworkPolicies: 'Disabled' + privateLinkServiceNetworkPolicies: 'Enabled' + } + } + ] + } +} + +@description('The subnetId required for the instance pool creation.') +output subnetId string = virtualNetwork.properties.subnets[0].id + +@description('The name of the sql instnce pool to be created.') +output sqlInstancePoolName string = sqlInstancePoolName diff --git a/avm/res/sql/instance-pool/tests/e2e/waf-aligned/main.test.bicep b/avm/res/sql/instance-pool/tests/e2e/waf-aligned/main.test.bicep new file mode 100644 index 0000000000..ffaa207271 --- /dev/null +++ b/avm/res/sql/instance-pool/tests/e2e/waf-aligned/main.test.bicep @@ -0,0 +1,62 @@ +targetScope = 'subscription' + +metadata name = 'WAF-aligned' +metadata description = 'This instance deploys the module in alignment with the best-practices of the Well-Architected Framework.' + +// ========== // +// Parameters // +// ========== // + +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'dep-${namePrefix}-sql.instancepool-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param resourceLocation string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +// e.g., for a module 'network/private-endpoint' you could use 'npe' as a prefix and then 'waf' as a suffix for the waf-aligned test +param serviceShort string = 'sipwaf' + +@description('Optional. A token to inject into the name of each resource. This value can be automatically injected by the CI.') +param namePrefix string = '#_namePrefix_#' + +// ============ // +// Dependencies // +// ============ // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: resourceLocation +} + +module nestedDependencies 'dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies' + params: { + virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}' + managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' + pairedRegionScriptName: 'dep-${namePrefix}-ds-${serviceShort}' + nsgName: 'dep-${namePrefix}-nsg-${serviceShort}' + routeTableName: 'dep-${namePrefix}-rt-${serviceShort}' + sqlInstancePoolName: '${namePrefix}${serviceShort}001' + location: resourceLocation + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../../main.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}' + params: { + name: nestedDependencies.outputs.sqlInstancePoolName + location: resourceLocation + skuName: 'GP_Gen8IM' + subnetResourceId: nestedDependencies.outputs.subnetId + } +} diff --git a/avm/res/sql/instance-pool/version.json b/avm/res/sql/instance-pool/version.json new file mode 100644 index 0000000000..8def869ede --- /dev/null +++ b/avm/res/sql/instance-pool/version.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#", + "version": "0.1", + "pathFilters": [ + "./main.json" + ] +}